I just downloaded the Realtime Netflow Analyzer for testing against a Cisco 2921 router. I enabled netflow on a Gi ethernet port on the router, and on a Multilink Interface (2 T1s bonded). In both cases, despite the fact that each interface has only 1 IP address, the Netflow Analyzer showed multiple interfaces on each real interface. On a 2nd 2921 the Multilink port actually showed 20+ interfaces. Can anyone tell me what is going on? I want to see traffic on the port and I cannot decide which is correct or if all traffic is being seen.